A few weeks ago, I set up a brand-new computers for a new hires, from first boot to first login. Here is the process I follow to make sure every device meets both productivity and security standards before it reaches an end user:

Identity first.

The device is joined directly to Microsoft Entra ID  no local accounts, no manual domain joins so identity and access controls are enforced before the user ever signs in.

1. Unboxed and Initial Setup

Before a single cable is plugged in, I check the basics: whether the device meets the baseline for Windows 11 and modern management (Entra ID join, Intune enrollment, Windows Hello for Business). 

2. Connected to Microsoft 365

Each device is joined directly to Microsoft Entra ID,  no local accounts, no manual domain joins. This gives us centralized identity and access management, and Conditional Access enforcement before the user ever signs in.

3. Configure Key Saas Applications

With identity in place, I set up the core productivity stack the user will rely on daily:

• Exchange Online:  mailbox profile configured in Outlook, mobile mail access verified
• SharePoint: access to team and department sites confirmed, permissions checked
• Teams:  chat, calling, and meeting functionality tested end to end
• OneDrive:  sign-in configured, Known Folder Move enabled so Desktop/Documents/Pictures sync automatically, and sync status verified before handoff
• Third-party apps: any line-of-business or vendor applications the role requires, installed and licensed correctly

 4. Security Baseline Tested

• Microsoft security baselines (or your org’s hardened baseline) are actually applied, not just assigned.
• MFA and Conditional Access policies trigger correctly for this device/user combination
• BitLocker is enabled and keys are in Entra ID

5.Onboarded the New Employee

Onboarding the person, not just the device. Once the technical foundation is solid, onboarding becomes about the employee: account access, MFA registration, and a short security awareness briefing  including how to recognize and respond to MFA fatigue attacks.

Key Takeaways

1. Identity comes before the user
   • Entra ID Join establishes the device within the organization’s identity architecture.
   • Avoid unmanaged local accounts and ad-hoc domain joining.
   • The goal is to have identity and access controls in place before the first user login

Written by Muhidin warsame

Key Takeaways

1. Identity comes before the user
   • Entra ID Join establishes the device within the organization’s identity architecture.
   • Avoid unmanaged local accounts and ad-hoc domain joining.
   • The goal is to have identity and access controls in place before the first user login
   • Device → Identity → Management → Applications → Security Controls → User → Validation

My blog

Written By Muhidin warsame